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(54) Information entry validation system and method for a dialysis machine 

(57) Information is entered and validated by the 
operator of a dialysis machine (30) by converting (230) 
the entered information into a first form using a first con- 
version relationship such as ASCII. The information in 
the first form is next converted (238) into a second form 
using a second conversion relationship, such as floating 
point numeric. Thereafter the information in the second 
form is converted (244) back to the first form using the 
first conversion relationship. The information in the first 
form which resulted from the third conversion (244) is 
displayed (246 and 248) for acceptance for rejection by 
the operator. Displaying the information resulting from 
sequential multiple conversions (230, 238, and 244) 
assures an opportunity for the operator to evaluate the 
entries for accuracy. Re-display of the previously 
entered information repeatedly presents the operator 
with an opportunity to recognize human-induced errors. 
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Description 

[0001] The present invention relates to a new and 
improved dialysis machine and method of validating 
information entered by a machine operator to control 
the machine during dialysis treatment. More particu- 
larly, the present invention effectively confirms that the 
entered information is what the operator intended and 
that the machine validly accepted the information, all of 
which occurs more conveniently for the operator while 
maintaining safety according to commonly accepted 
safety standards. 

Cross Reference To Related Inventions 

[0002] This invention is related to the inventions 
described in U.S. patents for a Graphical Operator 
Machine Interface and Method for Information Entry and 
Selection in a Dialysis Machine, U.S. Patent No. 
5,609,770, and for a Single Microcontroller Execution of 
Control and Safety System Functions in a Dialysis 
Machine, U.S. Patent No. 5,618,441 , both of which were 
filed concurrently herewith. The disclosures of these 
patents are incorporated herein by this reference. 

Background of the Invention 

[0003] In general, a dialysis machine is used as a sub- 
stitute for the natural kidney functions of a human body. 
As such, the dialysis machine cleanses the blood of the 
natural accumulation of bodily wastes and separates 
the wastes from the blood outside of or extracorporeal ly 
of the body. The separated wastes are discharged, and 
the cleansed blood is returned to the body. 
[0004] The wastes are separated from the blood in a 
dialyzer. The dialyzer includes an internal housing 
which is separated by a porous medium into a blood 
side or compartment and a dialysate side or compart- 
ment. The blood removed from the patient flows through 
the blood side of the dialyzer. A prepared solution of dia- 
lysate is passed through the dialysate side of the dia- 
lyzer. The wastes from the blood pass through the 
medium by osmosis, ionic transfer or fluid transport into 
the dialysate and, depending upon the type of dialysis 
treatment, desirable components from the dialysate 
may pass in the opposite direction through the medium 
and into the blood. The transfer of the wastes into the 
dialysate cleanses the blood while allowing the desired 
components from the dialysate to enter the blood- 
stream. 

[0005] As is apparent, the dialysis machine must be 
properly operated to perform effective dialysis in a safe 
and reliable manner. With the blood of the patient being 
removed and handled outside of the patient s body in an 
extracorporeal flow path, care must be taken that the 
treatment progresses safely and as intended according 
to the dialysis prescription for the patient. Since the 
patient's blood and the dialysate separated only by the 



dialyzer medium, it is apparent that numerous safety 
concerns must be satisfied on a continual and reliable 
basis. 

[0006] Because of the potential for extremely serious 

5 consequences resulting from a failure or other unsafe 
condition, modern dialysis machines incorporate a large 
number of safety features as well as extensive control 
system features. The safety features include sensors 
located in the extracorporeal and dialysate flow paths to 

10 derive signals representative of the operating conditions 
or parameters which indicate the proper operation of the 
dialysis machine and/or the early development of a 
safety or risk condition. The control system features 
result in operational control over the pumps, dialysate 

is heater, flow control valves and other devices associated 
with the extracorporeal and dialysate flow paths. 
[0007] Because of the pre-eminent importance of the 
safety system, all known modern dialysis machines uti- 
lize microcontrollers or similar types of processor 

20 devices to execute the safety functions. Generally 
speaking, modern microcontrollers offer a greater pos- 
sibility of more effective control over the safety features 
than other types of safety systems. Typically one micro- 
controller is used to execute the safety functions, and at 

25 least one and frequently two other microcontrollers exe- 
cute the control system functions. Upon recognizing a 
safety or risk condition, the safety microcontroller takes 
control of the dialysis machine and places it in a safe 
state which prevents or greatly reduces the risk of injury 

30 to the patient. 

[0008] In large measure, the use of separate micro- 
controllers for the safety and control systems is a result 
of the relatively stringent standards established by gov- 
ernmental, health and safety groups pertaining to dialy- 

35 sis machines. The multiple-microcontroller approach to 
achieving the basic safety and control system functions 
satisfies the regulatory standards by making the func- 
tionality of the safety system microcontroller independ- 
ent of and separate from the functionality of the control 

40 system microcontroller. 

[0009] The safety standards also apply to the entry of 
the information when setting up the machine to perform 
the dialysis treatment, as well as to the entry of informa- 
tion during the progress of the treatment. In general, the 

45 safety standards are concerned with promoting opera- 
tor accuracy when entering information, and assuring 
that the entered information is not corrupted before it is 
used by the control system and safety system microcon- 
trollers. 

so [001 0] Since in some cases the machine can not pro- 
tect against an operator-generated human error, many 
dialysis machines require the operator to enter informa- 
tion twice before the microcontrollers will accept the 
information. The theory behind the double-entry 

55 requirement is that the operator is more likely to recog- 
nize an error if the operator is required to check, view or 
consider the entered information twice. Generally the 
first entry results in the information being recorded in 
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memory and then displayed to the operator. After the 
operator has again entered the same information, the 
microcontroller compares the first and second entries. If 
the two entries are the same, the first entry previously 
recorded in memory will be transferred to the control 
system and safety system microcontrollers for use dur- 
ing the treatment. Other typical information entry tech- 
niques used in dialysis machines display the second 
entry in a separate location from the display of the first 
entry. The operator must then mentally compare the two 
entered values, and if they are equal, accept the 
entered value. In this double-display technique, the dial- 
ysis machine does not make the comparison, but 
instead leaves the comparison to the operator. 
[001 1] An example of a prior art double-display infor- 
mation entry technique is provided in U.S. Patent No. 
5,247,434, wherein an operator enters dialysis machine 
control information through the use of a touch screen 
key pad. Once the information has been entered (i.e., 
once the operator has pressed an ENTER button), the 
dialysis machine displays the newly entered information 
on the touch screen and prompts the operator to verify 
that the new information is accurate. The disclosed ver- 
ification process is performed by requiring the operator 
to press a VERIFY button on the touch screen within a 
predetermined amount of time (e.g. five seconds). 
Thus, the disclosed double-display technique requires 
an operator to manually verify each information entry. 
[0012] While the double-entry and double-display 
techniques have generally proved successful, it is 
somewhat tedious, repetitious and time-consuming for 
the operator. The typical machine setup procedure 
requires the entry of a significant number of different 
values, and the time associated with the double-entry 
detracts from the other activities required to ready the 
machine for treatment. Furthermore, the repetitiveness 
of the entries can lead to a type of monotony which may 
cause the operator to be less vigilant in visually compar- 
ing the two displayed values, or which results in a cer- 
tain level of tension and tedium resulting from making 
the second entry, or which results in frustration when 
the operator encounters difficulty in correctly entering 
the information in sequential entries. 
[0013] These and other considerations have contrib- 
uted to the evolution of the present invention which is 
summarized below. 

Summary of the Invention 

[0014] One of the significant aspects of the present 
invention pertains to an information entry system and 
method which requires the operator to enter the value 
only a single time, but which achieves a standard of val- 
idation that satisfies existing safety standards relating to 
the entry of information in dialysis machines. Another 
aspect of the invention relates to alerting the operator if 
the information which has been entered has been cor- 
rupted by the machine. Another aspect of the invention 



relates to entering and validating information in a man- 
ner which will assure that both the control system and 
safety system microcontrollers validly receive the same 
information which the operator has entered and 

5 approved. A further aspect of the invention relates to an 
information entry validation technique in which the 
proper functionality of certain input/output (I/O) devices 
is confirmed as an adjunct of the information entry. Still 
another aspect of the invention relates to a convenient 

10 and user-friendly technique for entering and confirming 
information used by a dialysis machine. 
[0015] In accordance with these and other aspects, 
the present invention pertains to a system and method 
for a dialysis machine in which entered control and 

15 safety information is validated. The machine includes an 
information entry device, for example a touch screen, 
and a display device, for example a cathode ray tube 
(CRT). A safety system of the machine receives infor- 
mation entered from the entry device. The entered infor- 

20 mation is first converted into a first form using a first 
conversion relationship. The information in the first form 
is next converted into a second form using a second 
conversion relationship. The second conversion rela- 
tionship is different from the first conversion relation- 

25 ship. Thereafter the information in the second form is 
converted back to the first form using the first conver- 
sion relationship. The information in the first form which 
resulted from the third conversion is displayed on a dis- 
play device for acceptance for rejection by the operator. 

30 [0016] The multiple sequential conversions provide 
the operator with an opportunity to evaluate the internal 
functionality of the machine and to determine if the 
machine has corrupted the entered information. A mal- 
function will usually result in the information being dis- 

35 played improperly or in an unusual form. Conversion of 
the information from one form into another form is likely 
to reveal that a corruption problem has occurred. Pres- 
entation of the displayed information only after and 
based on the sequential multiple conversions assures 

40 an opportunity for the operator to evaluate the entries 
for accuracy. With sequential entries, each new entry is 
subjected to the same series of conversions, but the col- 
lective value of the previous sequential entries is dis- 
played. The re-display of the previously entered 

45 information repeatedly presents the information to the 
operator, but in a naturally-appearing manner which 
does not create the impression of duplicity, redundancy 
or multiple confirmation. As a result, the entered infor- 
mation is validated in a more time-conserving and relia- 

50 ble manner, while reducing the operator's workload 
without compromising the degree of validation. 
[001 7] Preferred aspects of the invention involve using 
an ASCII conversion relationship for the first conversion 
and a floating point numeric conversion relationship for 

55 the second conversion. The font table is employed to 
derive the information displayed to the operator. The 
use of the font table further confirms a state of proper 
functionality in the machine by notifying the operator if 
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the characters presented are improper or unusual. 
Improper or unusual characters would result from an 
error in the font table. Furthermore using the same font 
table to derive the characters for all of the displayed 
information has the additional benefit of confirming sig- 5 
nificant parts of the overall machine functionality, apart 
from the information entry. 

[001 8] Other preferred aspects of the invention involve 
storing the entered information in the second form into a 
third permanent memory location after the value has 
been previously stored in the second memory location. 
After the operator has accepted all of the values previ- 
ously entered, the information in the second and third 
memory locations is compared. If the comparison 
reveals equal values in both locations, the information in 
the third memory location is displayed to the operator in 
a location which is different from that location where the 
same information was displayed while the operator 
entered the information. The information displayed from 
the third memory location is thereafter transferred to the 
control system of the dialysis machine for use during 
operation of the machine. An error detecting code is 
also calculated from the information in the second mem- 
ory location and is stored in association with the infor- 
mation in the third memory location. The error detecting 
code is employed to validate the transfer of the informa- 
tion to the control system and/or the safety system. 
[0019] Many other preferred aspects of the present 
invention, and a more complete appreciation of the 
present invention and its scope, may be understood 
from the accompanying drawings, which are briefly 
summarized below, from the following detailed descrip- 
tion of a presently preferred embodiment of the inven- 
tion, and from the appended claims. 

Brief Description of the Drawings 

[0020] 

Fig. 1 is a perspective view of a dialysis machine 
which incorporates the present invention. 
Fig. 2 is a generalized view illustrating a dialyser, an 
extracorporeal flow path for blood from a patient 
through the dialyzer, and a hydraulics flow path for 
dialysate through the dialyzer, as are present dur- 
ing treatment of a patient with the dialysis machine 
shown in Fig. 1. 

Fig. 3 is a block diagram of the control system and 
safety system of the dialysis machine shown in 
Figs. 1 and 2, illustrating the components which 
accomplish information entry validation according 
to the present invention. 

Fig. 4 is an illustration of a screen display initially 
presented on a monitor of the dialysis machine 
shown in Figs. 1 and 3, prior to entry of information. 
Fig. 5 is an illustration similar to that shown in Fig. 
4, upon which a keypad is displayed for the entry of 
information. 



Figs. 6, 7 and 8 are screen displays similar to those 
shown in Figs. 4 and 5, which illustrate other dis- 
plays during the entry and validation of information 
according to the present invention. 
Figs. 9A and 9B collectively form a single flow chart 
which illustrates steps involved in the entry and val- 
idation of information by a operator machine inter- 
face and safety microcontroller shown in Fig. 3. 
Fig. 1 0 is another illustration of some of the steps in 
the flow chart shown in Fig. 9A and the relationship 
of those steps with a temporary memory array and 
a temporary numeric memory shown in Fig. 3. 
Fig. 11 is an illustration of some of the steps in the 
flow chart shown in Fig. 9B and the relationship of 
those steps with a permanent memory shown in 
Fig. 3. 

Detailed Description 

[0021] An example of a dialysis machine with which 
the present invention may be advantageously employed 
is shown at 30 in Fig. 1. The dialysis machine 30 
includes the devices generally shown in Fig. 2, and 
those devices establish an extracorporeal flow path and 
a hydraulics flow path. The extracorporeal flow path 
conducts blood from a patient 32 to a dialyzer 34, and 
then returns the blood from the dialyzer 34 to the patient 
32. The hydraulics flow path conducts dialysate from a 
supply 36 to the dialyzer 34, and then returns the used 
dialysate to a waste drain 38. 

[0022] The blood in the dialyzer 34 is confined to a 
blood chamber 40, and the dialysate in the dialyzer 34 
is confined to a dialysate chamber 42. The blood cham- 
ber 40 and the dialysate chamber 42 are separated by a 
micro-porous or other type of dialysis medium 44. The 
waste products contained in the blood within the blood 
chamber 40 are transferred through the medium 44 by 
osmosis, ionic transfer or flow transfer to the dialysate in 
the dialysate chamber 42. Desirable components of the 
dialysate in the dialysate chamber 42 may also be 
transferred to the blood in the blood chamber 40 by the 
same mechanisms. In this manner, the waste products 
are removed from the patient's blood, and the cleansed 
blood is returned to the patient 32. The used dialysate 
flowing from the dialysate chamber 42 discharges the 
waste products into the drain 38 which may be a public 
sewer. 

[0023] The elements of the extracorporeal flow path 
include at least one blood pump 46 which controls the 
flow of blood from the patient 32. An arterial line or tub- 
ing 48 extends through an arterial clamp 50 to a blood 
handling cartridge 52. The blood handling cartridge 52 
is normally retained behind a door 54 of the machine 30 
when used. The blood handling cartridge 52 is not 
shown in Fig. 1. The blood pump 46 also is located 
behind the door 54 and adjacent to the cartridge 52. 
The blood pump 46 is typically a peristaltic pump in dial- 
ysis machines. 
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[0024] Blood flows through the arterial line 48 and into 
an arterial chamber 56 of the cartridge 52. The blood 
pump 46 draws blood from the arterial chamber 56 
through a pump tubing 58 which is squeezed or pinched 
by a rotating rotor 60 against a stationary raceway 62, in 
the typical manner of peristaltic pumps. The blood 
within the pump tubing 58 which is trapped rotationally 
in front of the point where the rotor 60 pinches the pump 
tubing is propelled through the pump tubing 58 and into 
a manifold 64 of the cartridge 52. A tubing 66 conducts 
the blood from the manifold 64 of the cartridge 52 into a 
blood inlet of the dialyzer 34. 

[0025] The cleansed blood flowing from an outlet of 
the dialyzer 34 is transferred through a tubing 67 back to 
a venous chamber 68 of the cartridge 52. Blood from 
the venous chamber 68 is removed from the cartridge 
52 through a venous tubing or line 70. Although not 
shown in Fig. 2, a venous blood pump similar to the 
arterial blood pump 46 may be located in the venous 
line to assist in forcing the blood back into the patient 32 
or to regulate the flow of blood through the extracorpor- 
eal flow path. If employed, the venous blood pump is 
positioned behind a second door 72 of the dialyzer 
machine 30 shown in Fig. 1 . 

[0026] After leaving the venous chamber 68 the blood 
flows through the venous line 70 to an air detector 74. 
The air detector 74 derives signals related to any air in 
the venous line 70. If an excessive or dangerous 
amount of air is present, a venous line clamp 76 will 
immediately close to terminate the flow of blood through 
the venous line 70 before the air reaches the patient 32. 
[0027] Because the blood in the extracorporeal flow 
path is prone to clot, a blood anticoagulant such as 
heparin is injected into the extracorporeal flow path. The 
anticoagulant is slowly delivered from a syringe 78 as a 
result of a linear driver mechanism (not shown) moving 
a plunger 80 into the syringe 78. Anticoagulant from the 
syringe 78 is introduced into the arterial chamber 56 of 
the cartridge 52 through a tubing 82. The syringe 78 
and the linear driver mechanism are typically referred to 
as an anticoagulant pump. 

[0028] The elements of the hydraulics flow path 
include a number of different valves (some of which are 
not shown) and a dialysate pump 84 which draws dia- 
lysate from the supply 36. The supply 36 is typically a 
mixture of chemicals and water which the dialysis 
machine prepares as the dialysate is used, or a previ- 
ously prepared quantity of dialysate which is delivered 
to the dialysis machine 30. The dialysate pump 84 
draws the dialysate from the supply 36 and delivers it 
through a dialysate supply tubing or line 86 to an inlet of 
the dialysate chamber 42 of the dialyzer 34. The dia- 
lysate flows past the medium 44 where it absorbs the 
waste products from the blood in the blood chamber 40. 
Any beneficial components within the dialysate which 
are desired to be transferred to the blood pass through 
the medium 44 and into the blood in the blood chamber 
40. 



[0029] Prior to entering the dialyzer 34, the dialysate 
is heated in a heater 88 to the normal human body tem- 
perature. The temperature of the dialysate entering the 
dialyzer 34 should be at body temperature to avoid 

5 removing or transferring heat to or from the patient. 
Excessively warm dialysate will harm blood cells. 
Excessively cool dialysate will chill the patient. Temper- 
ature sensors (not shown) are located in the dialysate 
supply line 86 to monitor the temperature of the dia- 

10 lysate. 

[0030] Conductivity sensors (not shown) are present 
in the dialysate supply line 86 to measure the conductiv- 
ity of the dialysate. The desired level of ionic transfer 
between the blood and the dialysate is achieved by pre- 

15 determined conductivity characteristics of the dialysate. 
[0031] The used dialysate containing the waste prod- 
ucts is removed from the dialysate chamber 42 through 
a dialysate waste tubing or line 90 by operation of a 
drain pump 94. The dialysate containing the waste 

20 products is delivered by the drain pump 94 to the waste 
drain 38. The waste drain 38 may be a separate con- 
tainer which accumulates the used dialysate and accu- 
mulated waste products, or it may simply be a public 
sewer. 

25 [0032] As a safety precaution, bypass valves 96 and 
98 are positioned at the inlet and the outlet of the dia- 
lysate chamber 42, respectively. The bypass valves 96 
and 98 are connected by a bypass line 100. Normally 
the bypass valve 96 directs the inflow of dialysate into 

30 the dialysate chamber 42, and normally the bypass 
valve 98 directs the outflow of dialysate into the dia- 
lysate waste line 90. If a safety condition is detected, the 
bypass valves 96 and 98 are operated to their alterna- 
tive states, thereby directing the flow of dialysate 

35 through the bypass line 100, and bypassing the flow of 
dialysate around the dialyzer 34. 
[0033] The elements of the extracorporeal flow path, 
which have generally been described above, are shown 
and referenced generally at 1 10 in Fig. 3. The extracor- 

40 poreal flow path elements 110 are controlled by an 
extracorporeal microcontroller 112 or other similar 
processing device, as shown in Fig. 3. The extracorpor- 
eal microcontroller 112 executes a program recorded in 
a memory 114 to control the extracorporeal flow path 

45 elements 110. 

[0034] The elements of the hydraulics flow path, which 
have generally been described above, are also shown 
and referenced generally at 116 in Fig. 3. The hydrau- 
lics flow path elements 1 16 are controlled by a hydrau- 

50 lies microcontroller 118 or other similar processing 
device. The hydraulics microcontroller 1 1 8 executes a 
program recorded in memory 120 to control the hydrau- 
lics flow path elements 116. 

[0035] An operator/machine interface (OMI) and 
55 safety microcontroller 122 is also connected to the 
extracorporeal flow path elements 1 1 0 and the hydraulic 
flow path elements 116. The OMI and safety microcon- 
troller 122 monitors the operating conditions in the 
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extracorporeal and hydraulics flow paths, and upon 
detecting a potentially risky condition for the patient, 
assumes control over, the extracorporeal and hydraulics 
flow path elements 110 and 116 to place them into a 
safe patient state. The safety microcontroller 122 exe- 5 
cutes a program recorded in its memory 1 24 to monitor 
the operating conditions of the dialyzer machine 30 and 
the patient 32 during dialysis treatment, to determine 
potentially hazardous conditions, and to place the dia- 
lyzer machine in a safe patient state upon the detection 10 
of a hazardous condition. 

[0036] The three microcontrollers 112, 118 and 122 
communicate with one another to exchange information 
and confirm proper functionality, among other things, by 
use of a bus or network 1 26. In general, the extracorpor- is 
eal microcontroller 112 and the hydraulic microcontrol- 
ler 118 are generally responsible for the control 
functions of the dialysis machine. The safety microcon- 
troller 122 is responsible for the safety functions of the 
dialysis machine. 20 
[0037] Use of the three microcontrollers meets the 
safety standards for dialysis machines. In general, the 
safety standards emphasize redundancy to avoid the 
possibility that a single equipment failure will place the 
patient in a hazardous condition. If the failure of a con- 25 
trol system microcontroller occurs, the safety system 
microcontroller is capable of placing the dialysis 
machine in the safe patient state. For example, should 
the hydraulics microcontroller 118 fail, the safety micro- 
controller 122 can assume control over the hydraulics 30 
flow path elements 1 1 4 to achieve the safe patient state. 
Similarly, should the extracorporeal microcontroller 1 12 
fail, the safety microcontroller 118 will assume control 
over the extracorporeal flow path elements 110 to 
achieve a safe patient state. If the safety microcontroller 35 
122 fails, the extracorporeal and hydraulics microcon- 
trollers are capable of placing the dialysis machine in a 
safe patient state. 

[0038] Although it is typical to use multiple microcon- 
trollers in dialysis machines to meet the safety stand- 40 
ards, a dialysis machine which meets safety standards 
while using only a single microcontroller for executing 
the control system and safety system functions is 
described in the above mentioned U.S. Patent No. 
5,61 8,441 for a Single Microcontroller Execution of Con- 45 
trol and Safety System Functions in a Dialysis Machine. 
The present invention may be utilized with either single 
or multiple microcontroller dialysis machines. 
[0039] Because it is necessary to enter various types 
of safety and operational information to achieve a partic- so 
ular dialysis treatment or prescription for a patient, the 
safety standards also govern the entry of information 
into the dialysis machine. In general, those standards 
are concerned with confirming to the operator that the 
information entered into the machine is what the opera- ss 
tor intends. It is also important that the operator know 
that the information entered is the information accu- 
rately stored in the memories 114, 120 and 124. The 



10 

other general safety concern regarding information 
entry is that the safety microcontroller 122 and the con- 
trol system microcontrollers 112 and 118 commence 
operations using the same entered information. If the 
safety and the control systems do not start with the 
same information, it will be extremely difficult or impos- 
sible to detect a difference in operation of the two sys- 
tems, and such a difference could give rise to a safety 
situation. 

[0040] The present invention achieves a more conven- 
ient and natural approach to entering and validating 
information into a dialysis machine, without compromis- 
ing the safety standards and while simultaneously sup- 
plying better information to the operator concerning the 
safety and operating conditions of the dialysis machine. 
[0041] The operator-machine interface (OMI) is the 
means by which information is entered into the dialysis 
machine and by which the entered information is vali- 
dated back to the operator. The OMI functionality is 
incorporated with that of the safety microcontroller 122 
shown in Fig. 3, or could be performed by its own micro- 
controller. By entering all information through the safety 
microcontroller 122, it is assured that the control system 
microcontrollers 112 and 118 will start with the same 
values or information which is initially recorded in the 
safety microcontroller 122. 

[0042] The preferred means for entering and for dis- 
playing the entered information back to the operator is a 
conventional touch screen 130 attached to a front view- 
ing surface of a conventional cathode ray tube (CRT) 
132. The touch screen 130 and the CRT 132 are incor- 
porated in a monitor 134 of the machine 30 shown in 
Fig. 1. 

[0043] The touch screen 130 is a thin transparent 
sheet assembly which physically overlays a front view- 
ing surface of the CRT 132. The overlaying relationship 
is generally illustrated in Fig. 3. With the touch screen 
130 in position, the images displayed on the Viewing 
surface of the CRT 1 32 define locations which the oper- 
ator may select by applying finger pressure to the touch 
screen 130 at the location of the images. The touch 
screen 130 generates signals which describe the X-Y 
coordinates of the position where the finger pressure is 
applied. Those signals are supplied to a conventional 
touch screen converter 136 which converts the X-Y sig- 
nals from the touch screen 130 into corresponding sig- 
nals which are supplied to the safety microcontroller 
122. The programmed functionality of the safety micro- 
controller 122 correlates the signals from the touch 
screen converter 136 with the location of the images 
displayed on the viewing surface of the CRT 132. The 
correlation is possible because signals are supplied by 
the safety microcontroller 122 to a video driver 138 to 
control the position and details of the images displayed 
on the viewing screen of the CRT 132. By correlating 
the X-Y position signals from the touch screen converter 
136 with the viewing images defined by the signals 
delivered to the video driver 138, the microcontroller 
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122 is able to recognize those selections made by the 
operator touching the touch screen 130. This functional- 
ity is typical and well known for touch screen input and 
output (I/O) devices. 

[0044] To alert the operator in the case of a safety or s 
other condition, an audio alarm 140 and a visual alarm 
142 are used in the dialysis machine 30. The audio and 
visual alarms 140 and 142 are controlled by a driver 
144. The driver 144 responds to control signals supplied 
by the safety microcontroller 122 to create a visual 10 
alarm or signal or an audio alarm or signal when neces- 
sary. 

[0045] An example of a visual display created by the 
safety microcontroller 122 and the video driver 138 is 
shown in Fig. 4. The visual display is shown as it 15 
appears on the viewing screen of the CRT 132, and it 
will therefore be referred to as a display screen 150. The 
display screen 150 is divided into different areas which 
present information concerning the functions and status 
of the dialysis machine. A relatively large main window 20 
area 152 shows a number of setup parameters for con- 
trolling the dialysis machine during treatment, in this 
example. A title bar 154 indicates that setup parameters 
shown in the main window 152. 

[0046] The eight setup parameters shown in the main 25 
window 152 are the patient identification number at 156, 
the type of dialysis treatment at 158, the time for the 
dialysis treatment at 160, the heparin infusion rate dur- 
ing the treatment at 162, the dialysate flow rate during 
treatment at 164, the profile for delivering sodium in the 30 
dialysate during the treatment at 166, the profile for 
delivering bicarbonate in the dialysate during the treat- 
ment at 168, and the target loss or volume of waste 
products to the removed from the patient's blood during 
the treatment at 170. Other types of setup parameters 35 
could be displayed. U.S. Patent No. 5,609,770 
described above for a Graphical Operator Machine 
Interface and Method for Information Entry and selec- 
tion in a Dialysis Machine describes an advantageous 
technique of selecting parameters and programming 40 
the dialysis machine. 

[0047] In addition to the main window 152, the right 
hand border (as shown) or some other selected area of 
the display screen 150 is occupied by images which 
allow the operator to select functional features of the 45 
display for purposes of entering information or monitor- 
ing the performance of the machine for the treatment. 
Touching a screen image 172 allows the operator to 
index among various displays and, for example, select 
the setup parameters, as is shown of at 172 and 154. so 
Touching the touch screen above a last screen image 
174 allows the operator to toggle between the present 
display screen 1 50 and the previously presented display 
screen. Touching a treatment setup-image 176 allows 
the operator to select from a list a dialysis functions that 55 
are expected to occur in conjunction with each treat- 
ment. A quick OPS image 178 allows the operator to 
select from a list of easy access functions that are not 



necessarily expected in each treatment. 
[0048] The on and off operation of the blood pump 46 
(Fig. 2) is controlled by touching the blood pump icon or 
image 180. The blood pump is turned on and off with 
each touch. The rate of blood pump operation may be 
adjusted incrementally upward or incrementally down- 
ward by touching an up arrow image 182 or a down 
arrow image 184, respectively. Continual finger pres- 
sure on either of the arrow images 182 or 184 causes 
repeated incrementation. When operating, the blood 
pumping rate is displayed in the location where the word 
"off" appears in the blood pump image 180. 
[0049] The bottom border or other designated area of 
the display screen 150 also includes a number of 
images or icons which represent control and monitoring 
conditions associated with the patient and the dialysis 
machine. The image at 186 which states "resume" is 
selected to resume treatment if the blood pump opera- 
tion has been stopped. 

[0050] The image at 188 which states "UF" accompa- 
nied by a downward pointing arrow is selected when it is 
desired to reduce the amount of ultrafiltration which may 
be occurring during a treatment. Ultrafiltration is a well- 
known aspect of some types of dialysis treatments 
which involves the direct introduction of an ultrafiltration 
solution into the blood. The ultrafiltrate may be intro- 
duced into the extracorporeal flow path prior to the 
blood reaching the dialyzer 34 (Fig. 2) or after the blood 
has passed through the dialyzer. Of course, if ultrafiltra- 
tion is not used during the treatment, no functionality will 
be achieved by touching the ultrafiltration image 188. 
[0051] The image displayed at 190 is an icon repre- 
sentative of the dialyzer 34 (Fig. 2). Touching the dia- 
lyzer image 190 results in bypassing the dialysate flow 
around the dialyzer. The image or icon of a heart at 192 
allows the operator to obtain information concerning the 
patient's blood pressure, if a blood pressure monitoring 
functionality is a part of the dialysis machine and a 
blood pressure cuff is connected to the patient. 
[0052] Organization of the display screen 150 in this 
manner allows a more convenient, time-conserving, 
reliable and safety-promoting approach to setting up the 
dialysis machine and operating the machine during the 
treatment, as is described more completely in the above 
referenced U.S. Patent No. 5,609,770 for a Graphical 
Operator Machine Interface and Method for Information 
Entry and Selection in a Dialysis Machine. 
[0053] One of important safety-promoting aspects of 
the display screen 1 50 is its interaction with the operator 
and with the functionality of the OM l/safety microcon- 
troller 122 (Fig. 3) in validating information, particularly 
numeric values, entered by the operator during the 
setup of the machine for dialysis treatments and during 
modification of the operating parameters of the machine 
while the dialysis treatment is progressing. The aspects 
of the information validation technique according to the 
present invention are represented in the flow chart 
shown in Figs. 9A and 9B, and are illustrated in the 
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screen displays shown in Figs. 4-8. 
[0054] The steps of the technique shown in the flow 
chart of Figs. 9Aand 9B are executed by the OM l/safety 
microcontroller 122 in conjunction with the memory 124 
connected to the microcontroller 1 22. Each of the steps s 
shown in the flow chart of Figs. 9A and 9B are sepa- 
rately identified by reference numbers for convenience 
of description. 

[0055] In order to employ the information validation 
technique of the present invention, the operator must 10 
first select a parameter to be modified or established. 
The selection of the parameter is shown in Fig. 9A at 
step 200. The selection is also shown in Fig. 4 where 
the touch screen is touched in the area above the 
screen image 1 72. The screen image 1 72 is highlighted is 
and the word "setup" appears. The fact that the setup 
parameters have been selected appears in the title bar 
154. The setup parameters which are available to the 
established or modified are shown in the main window 
152. 20 
[0056] For example, assume the operator desires to 
establish or change the value of the target loss of waste 
volume to the removed from the patient, as is displayed 
at 170. The operator presses the touch screen in the 
area above the target loss image 170 to select the tar- 25 
get loss setup parameter. The target loss image 170 is 
highlighted, as shown in Fig. 5, thereby indicating to the 
operator that the target loss parameter can now be 
established or modified. 

[0057] If the parameter selected for modification or 30 
establishment is one which allows selection of discrete 
numeric values, a keypad 202 (Fig. 5) is displayed on 
the display screen 150. The signals which define the 
keypad display 202 are created by the microcontroller 
122 and the video driver 138 (Fig. 3), and the CRT 132 35 
(Fig. 3) creates the keypad 202. The keypad 202 is pre- 
sented in place of some of the images which otherwise 
occupy the right hand and bottom border areas of the 
display screen 150, as can be seen by comparing Figs. 
4 and 5. 40 
[0058] The keypad 202 includes areas which define 
numeric buttons 204, a selected parameter display area 
206 which presents a title corresponding to the parame- 
ter selected at 170, a decimal point button 208, an 
escape button 210, a clear button 212, and an enter but- 45 
ton 21 4. In addition, an up arrow 216 and a down arrow 
218 are located adjacent to the display area 206 to be 
used for incrementing the value of the parameter shown 
in the display area 206, either upwardly or downwardly. 
[0059] The logical and sensible display of the keypad so 
202 provides the very important information that the 
safety microcontroller 122 and a font table 220 (Fig. 3) 
of the memory 124 are correct and operating properly. 
The font table 220 contains information from which the 
signals for creating the numbers in the keypad 202 are ss 
derived. If the numbers on the keypad 202 are not prop- 
erly formed, or if the numbers are not located in the 
positions where the operator expects them to be 



located, a malfunction can be immediately detected. 
The operator will recognize the malfunction as making 
the dialysis machine unreliable. Thus, the use of the font 
table 220 to create the keypad 202 is an important 
aspect of information supplied to the operator concern- 
ing the validation and proper functionality of the dialysis 
machine. Assuming that the information presented in 
the keypad 202 is correct, the operator will continue with 
the information validation technique of the present 
invention and use of the dialysis machine. 
[0060] The described functionality which presents the 
keypad 202 is shown at step 222 in Fig. 9A. After dis- 
playing the keypad at step 222, the program flow ceases 
until an entry or selection made by touching the screen 
is detected at 224. A determination is made at 226 
whether the selection detected at step 224 was from the 
enter button 214 (Fig. 5) or from some other button from 
the keypad display 202. The purpose of the enter button 
214 is to represent the final acceptance of all of the 
information or numeric values which have just been 
entered. Until the operator finally accepts the selected 
information by touching the enter button 214 (Fig. 5), 
the program flow will continue at the step 228. 
[0061] The step 228 involves converting the X-Y sig- 
nals from the touch screen 130 into an entry value 
obtained by touching the numeric buttons 204 (Fig. 5), 
by use of the touch screen converter 136 (Fig. 3) and 
the correlation of the signals from the converter 1 36 with 
the signals generated by the microcontroller 122 to dis- 
play the numeric values in the keypad 202 (Fig. 3). 
[0062] The entry value derived at step 228 is thereaf- 
ter converted at step 230 into an ASCII value. Typically 
the entry value determined at step 228 is directly mem- 
ory mapped to an ASCII value. ASCII values are 
employed for the purpose of displaying all of the num- 
bers and characters. 

[0063] Rather than immediately display the ASCII 
value derived from the step 230, the information entry 
validation technique of the present invention employs 
additional important steps to confirm the accuracy and 
acceptability of the entered value to the operator while 
simultaneously confirming the proper operation and 
acceptance of the value by the safety microcontroller. 
After the entered value is converted to the ASCII value 
at step 230, the ASCII value is stored at step 232 in a 
temporary array 234 (Fig. 3) of the memory 124. The 
temporary memory array 234 is a collection of memory 
locations or cells in which the ASCI I value for each entry 
is separately stored. The individual locations or cells of 
the array 234 to which the ASCII values derived from 
each entry are separately stored are shown individually 
at 236a, 236b, 236c,... 236n in Fig. 10. 
[0064] After the ASCII value has been stored in the 
temporary array at step 232, the microcontroller 122 
(Fig. 3) immediately converts the stored ASCII value 
into a different representation of the same information 
or value represented by the ASCII value, such as a 
numeric value, preferably a floating point numeric value. 
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The conversion to the different form is shown at step 
238 in Figs. 9A and 10. The numeric value derived at 
238 is stored at 240 in a temporary numeric memory 
location 242 (Fig. 3) of the memory 124. The temporary 
numeric memory location 242 is a segment or location 5 
within the memory 124 which the microcontroller 122 
designates for receiving the numeric value. 
[0065] Using the numeric value stored in the tempo- 
rary memory location at step 240, the numeric value is 
immediately converted back into an ASCII value at Step 
244. The font table 220 (Fig. 3) may be used in this con- 
version if the inherent functionality associated with the 
conversion does not immediately convert the floating 
point numeric value into an ASCII value. The ASCII 
value thus derived is thereafter applied to the video 
driver 138 (Fig. 3), and in response, the video charac- 
ters corresponding to the ASCII value are generated, as 
shown at 246 in Fig. 9A. The CRT 132 (Fig. 3) displays 
the character to the operator as shown at 248 in Fig. 9 A. 
The display of the value appears in the display area 206 
of the keypad 202 as shown in Fig. 6. Fig. 6 illustrates 
the circumstance where the numeric "6" button 204 has 
been selected by finger pressure, resulting in the 
number "6" being presented in the display area 206 
(Fig. 6). In the example shown in Fig. 6, the entered 
value of "6" is the first value of 3 values to be entered. 
[0066] After the selected characters are displayed in 
the display area 206 (Fig. 6) of the keypad as shown at 
step 248 in Fig. 9A, the program flow reverts back to the 
step at 224 to detect another entry or selection of infor- 
mation. With each subsequent entry of information the 
steps beginning at 228 and ending at 248 are executed. 
However, each separate information selection is stored 
in a separate memory cell 236a, 236b, 236c ... 236n, 
shown in Fig. 10. In the example shown by comparing 
Figs. 6 and 7, the first ASCII entry (the numeric value 
"6") is stored in the cell 236a; the second ASCII entry 
(the decimal point) is stored in cell 236b; and the third 
ASCII entry (the numeric value "3") is stored in cell 
236c. If the entered information included additional 
selected values, all of the additional entries would be 
stored to subsequent memory cells and the last or nth 
ASCII entry would be stored in the last cell 236n. 
[0067] Each time a numeric value is derived at step 
238, all of the values which have previously been 
recorded in the cells 236a, 236b, 236c, ... 236n are used 
in the ASCII-to-numeric conversion, as is shown in Fig. 
10. In this manner, the value displayed at step 248 (Fig. 
9A) constitutes a measure of the collective accuracy of 
each value previously and presently entered. Since the 
collective information of all of the previous values is 
used in the last ASCII to numeric conversion, rather 
than simply updating the information previously dis- 
played with each new conversion, any mistake in the 
selected values is likely to be recognized by the opera- 
tor. 

[0068] Furthermore, the entry and conversion tech- 
nique provides the operator with an effective indication 



of whether the stored information may have become 
corrupted. Should the operator receive the display of a 
value which the operator did not enter, or if a previously 
entered value suddenly changes with a subsequent 
entry, corruption of the entered information is sug- 
gested. A circumstance of a computational malfunction 
in the two conversions (ASCII to numeric, and numeric 
back to ASCII) might also be suggested. In either cir- 
cumstance, the operator is alerted to a potential mal- 
function within the dialysis machine, and the operator 
should recognize that the machine should not the used 
for the dialysis treatment. 

[0069] The use of the font table to display the values 
also provides a continuing indication of the functionality 
of the system. Preferably the font table is the only font 
table employed in the safety system for the display of 
information to the operator. By use of the single font 
table, the potential problems of corruptions of multiple 
font tables is avoided. Reference to a single font table 
for all displayed characters is more likely to reveal a mal- 
function within the system, since data displayed by use 
of the single font table will indicate corruption through 
the improper display of that data. The likelihood that the 
font table itself has become corrupted will be apparent if 
other information displayed to the operator is improper. 
These types visual cues provided through the display of 
information constitute a continuing integrity check of the 
functionality of the safety system microcontroller 122. 
[0070] Further still, the display of the entered informa- 
tion also creates certain inherent protections against 
operator induced errors. The repetitive display of the 
information previously entered constitutes a require- 
ment that the operator continually accept the previous 
values as well as the present values entered. Each sub- 
sequent step of entering additional values inherently 
causes the operator to re-evaluate the previous infor- 
mation presented on the display area 206 of the keypad 
202 (Fig. 5). Consequently the entry process inherently 
creates a naturally-appearing requirement for reconsid- 
eration and re-validation of the previously entered infor- 
mation. However, this form of re-validation occurs 
inherently in conjunction with the natural process of 
entering each new value, not as an artificial and time- 
consuming requirement to specifically enter data twice 
or to look at data appearing in two different locations on 
the dialysis machine. Validation of the entered informa- 
tion appears transparent to the operator, but the integ- 
rity of the validation does not compromise safety or 
encourage inattentive or slack practices by the Opera- 
tor. Entered information is validated in a manner which 
appears natural and second-nature to the operator. The 
awkward, time-consuming and somewhat frustration- 
prone necessity to continually compare two different 
values displayed at different locations on a screen, or to 
enter values twice, is avoided. 
[0071] After all of the information has been entered in 
the manner shown and described in conjunction with 
Fig. 9A, the resulting end value is displayed in the dis- 
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play area 206 of the keypad 202, as is shown by the 
example of the value "6.3" in Fig. 7. The value thus 
derived is stored in the temporary ASCII array 234 (Fig. 
3) and in the temporary numeric memory 242. Even 
though the desired value may be displayed correctly, 
this value will not be accepted for use by either the 
safety microcontroller 122 or the extracorporeal or 
hydraulics microcontrollers 112 and 1 18 of control sys- 
tem. 

[0072] To make an entered value available for use by 
the control and safety system of the dialysis machine, 
the operator must select the enter button 214 as shown 
in Fig. 7. Selection of the enter button 214 initiates the 
program flow shown in Fig. 9B to assure that the infor- 
mation which has been validated by the operator will be 
recorded in a permanent memory segment 250 (Fig. 3) 
of the safety system memory 124. Once the value is 
recorded in the permanent memory segment 250, the 
control system microcontrollers 122 and 118 gain 
access to the information by reading the values in the 
permanent memory from the network 126. Touching the 
enter button causes the temporary ASCII memory array 
236a, 236b, 236c, etc. to become available for reuse 
during the same process with the next selected informa- 
tion. 

[0073] Detection of the enter button at step 226 
causes the microcontroller 122 to calculate a cyclic 
redundancy check (CRC) value based on the informa- 
tion contained in the temporary memory location 242. 
The calculation of the CRC occurs at step 252 as shown 
in Figs. 9B and 1 1 . A CRC is a value derived from the bit 
structure of the particular value contained in the tempo- 
rary memory location 242, and the CRC is used to 
detect errors that may occur from corruption of the value 
occurring after the CRC has been calculated. Errors of 
this nature may sometimes arise from failures of mem- 
ory or due to corruption occurring when information is 
transferred to or obtained from memory within the com- 
puter system. The CRC may be calculated by using any 
number of well known CRC calculation algorithms. 
[0074] After calculation of the CRC at 252, the calcu- 
lated CRC is associated with the numeric value from 
which it was calculated, and the numeric value and its 
corresponding CRC are stored in the permanent mem- 
ory location 250 (Fig. 3), as shown at the step 254. The 
values stored in the permanent memory location 250 
are in a form acceptable for use and transfer between 
the safety system and the control system microcontrol- 
lers of the dialysis machine. However before the 
numeric and CRC values are made available for use by 
the management system, a further validation of the val- 
ues recorded in the permanent memory 250 is per- 
formed. 

[0075] The numeric value stored in the temporary 
numeric memory location 242 is compared at step 256 
to the numeric value stored in the permanent memory 
location 250. If the comparison at 256 reveals that the 
values in the two memory locations 242 and 250 are dif- 



ferent, an error has occurred and the value stored in the 
permanent memory 250 is not reliable or consistent with 
the value which has previously been validated and 
accepted by operator action as represented by the 

5 value located in the temporary memory 242. In this cir- 
cumstance, all previously entered values in the tempo- 
rary memory locations 234 and 242 and in the 
permanent memory 250 are erased at step 258 and the 
program flow reverts back to step 224 (Fig. 9A). Erasing 

10 the values causes the operator to commence again the 
information entry and validation procedure shown in 
Fig. 9A. 

[0076] If the comparison performed at 256 reveals that 
the values in memory at 242 and 250 are equal, the key- 

15 pad display 202 is erased from the display screen 1 50 
by the step shown at 260 in Fig. 9B. The absence of the 
keypad 202 from the display screen is shown in Fig.8. 
Thereafter, the value in the permanent memory 250 is 
converted to an ASCII value, as shown at 262. Again, 

20 the font table 220 may be employed to make the conver- 
sion if it is not inherent in the program which establishes 
the numeric value. 

[0077] The microcontroller 122 supplies the ASCII 
value derived from the conversion at step 262 to the 

25 video driver 1 38, as shown at step 264, and the signals 
from the video driver 138 are used by the CRT 132 to 
display the final value, as shown at step 266. The final 
value displayed at 266 is the same value which was 
accepted by the operator by touching the enter button 

30 214 of the keypad 202. However, since the keypad 202 
has been erased at step 260, the final value is displayed 
on the setup parameter button 170 (Fig. 8) which was 
initially selected at step 200 to initiate the information 
entry and validation technique of the present invention. 

35 [0078] After acceptance of the value in the permanent 
memory as determined by the comparison at 256, the 
value in the permanent memory 250 is available to be 
transferred to and used by the management system 
extracorporeal and hydraulics microcontrollers 112 and 

40 118, respectively. Transfer of the value to the microcon- 
trollers 1 1 2 and 1 1 8 results in that value being stored in 
their memories 114 and 120, respectively, as is shown 
at step 268. The use of permanent memory 250 (Fig. 3) 
for storing the values used by the safety microcontroller 

45 122 assures that those values will be available to the 
safety system after start-up following a power loss to the 
dialysis machine. 

[0079] The information entry validation technique of 
the present invention achieves a number of significant 

so improvements for the operators of dialysis machines. 
The information entered by the operator is inherently 
validated in a convenient and time-conserving manner, 
as a natural adjunct to the entry of information itself. The 
entire value displayed is represented to the operator 

55 with each subsequent entry. Each subsequent entry 
therefore confirms all of the previous entries and 
presents the result to the operator. Should the operator 
have failed to recognize an error occurring from a previ- 
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ous entry, each subsequent entry of information 
presents another opportunity for the operator to recog- 
nize a previous error. Furthermore, the final entered 
value must be accepted by the operator by selecting the 
enter button to re-affirm the final acceptance of the 5 
entered information. The removal of the keypad upon 
selection of the enter button and the resulting display of 
the final value in the parameter setup button requires 
the operator to again confirm the value. These proce- 
dures for presenting information to the operator for con- 10 
firmation appear to the operator as natural sequential 
events, not the redundant and repetitious double-entry 
and double-display confirmation operations which are 
typical in the prior art. As a result, the operator is less 
likely to make mistakes arising from boredom, from inat- 15 
tention inherent in repeating redundant actions, or from 
tension and tedium caused by the typical double-entry 
requirements of prior art dialysis machines. Further- 
more, these significant operator advantages are 
obtained without compromising safety, and while meet- 20 
ing the safety and governmental standards which apply 
to dialysis machines. Further still, the present invention 
allows the operator to enter information more rapidly 
while still achieving these significant conveniences. 
[0080] The information entry validation technique of 25 
the present invention also offers significant improve- 
ments in the functional operations associated with the 
information entry and validation. The use of two sepa- 
rate conversions, such as ASCII to floating point 
numeric, serves as a double-check on the functionality 30 
of the machine. Furthermore the use of a single font 
table by which to achieve the conversions eliminates the 
possibility that errors could occur in one font table that 
were not present in another font table. The use of multi- 
ple memory locations to store values obtained from the 35 
two conversions, and to store the permanent value sub- 
stantially reduces the possibility that an error in the 
memory might allow a corrupted value to be used by the 
dialysis machine. The comparison of the temporary and 
permanent values before the final value is accepted for 40 
use by the control and safety systems of the machine 
constitutes a further check on the validity of the 
accepted information. Many other significant improve- 
ments will be recognized after the present invention is 
fully comprehended and appreciated. 45 
[0081 ] A presently preferred embodiment of the i nven- 
tion and many of its improvements have been described 
with a degree of particularity. This description is a pre- 
ferred example for implementing the invention, and is 
not necessarily intended to limit the scope of the inven- so 
tion which is defined by the following claims. 

Claims 

1. A dialysis machine (30) having a control system 55 
operative for controlling the operation of the 
machine and including a control system memory 
within which to record machine operating informa- 



tion, a display device (132) and an information entry 
device (130) by which an operator enters control 
and safety information for use by the machine, said 
dialysis machine (30) comprising: 

a safety system connected to the information 
entry device (130) and the display device (132), 
the safety system including: 

a safety system memory (124) having a 
first memory location (234) and a second 
memory location (242); 
means for converting information entered 
from the entry device (130) into a predeter- 
mined form which may be used for the con- 
trol system; 

means for storing the information in the 
predetermined form in the first memory 
location (234); 

means for copying the information stored 
in the first memory location (234) to the 
second memory location (242); 
means for comparing the information 
stored in the first and second memory 
locations (234 and 242); and 

means for erasing the information in the first 
memory location (234) and maintaining the 
information in the second memory location 
(242) and for copying the information from the 
second memory location (242) to the control 
system memory upon the comparison of the 
information in the first and second memory 
locations indicating equality. 

2. A dialysis machine (30) as defined in claim 1 
wherein the safety system further includes: 

means for calculating a error detecting code 
based on the information stored in the first 
memory location (234); and 
means for storing the error detecting code in 
the second memory location (242) along with 
the information copied from the first memory 
location (234) and for copying the error detect- 
ing code with the information in the second 
memory location (242) to the control system 
memory. 

3. A dialysis machine (30) as defined in claim 2 
wherein the safety system further includes: 

means for controlling the display device (132) 
to display the information stored in the first 
memory location (234) in a user-readable form; 
means for registering operator acceptance of 
the information displayed from the first memory 
location (234); and wherein: 
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the means for copying, the means for compar- 
ing and the means for erasing, maintaining and 
copying become operative to perform their 
respective recited functions upon registration 
of acceptance of the information displayed from 5 
the first memory location (234). 

4. A method of entering control and safety information 
into a dialysis machine (30) for use during a dialysis 
treatment of a patient using the machine, said dial- 10 
ysis machine (30) having a control system with a 
memory, a safety system with a memory, a display 
device (132) and an information entry device (130), 
said method comprising the steps of: 

15 

dividing the memory of the safety system into a 
first memory location (234) and a second mem- 
ory location (242); 

entering treatment information using the entry 
device (130); 20 
converting the treatment information into a pre- 
determined form which may be used by the 
control system; 

storing the information in the predetermined 
form in the first memory location (234); 25 
copying the information stored in the predeter- 
mined form in the first memory location (234) to 
the second memory location (242); 
comparing the information in the first and sec- 
ond memory locations (234 and 242), and 30 
upon the information in the first and second 
memory locations indicating equality: 



ory after the operator accepts the displayed 
information. 

6. A method as defined in claim 5 further comprising 
the steps of: 

calculating an error detecting code from the 
information stored in the first memory location 
(234); and 

storing the error detecting code in the second 
memory location (242) along with the informa- 
tion stored in the predetermined form in the 
second memory location (242), and 
performing the steps of calculating and storing 
the error detecting code after the operator 
accepts the displayed information. 

7. A method as defined in claim 5 or 6 further compris- 
ing the steps of: 

recording a single font table (220) in the mem- 
ory of the safety system; and 
displaying the user-readable form of the infor- 
mation stored in the first memory location (234) 
using only the single font table (220). 



erasing the information in the first memory 
location (234); 35 
maintaining the information in the second 
memory location (242) ; and 
copying the information from the second 
memory location (242) to the control sys- 
tem memory. 40 

5. A method as defined in claim 4 further comprising 
the steps of: 

converting the information stored in the first 45 
memory location (234) to a user-readable form; 
displaying the user-readable form of the infor- 
mation stored in the first memory location 
(234); 

requiring an operator of the machine to accept so 
the information displayed; and 
performing the steps of copying the information 
to the second memory location (242), compar- 
ing the information, erasing the information 
from the first location, maintaining the informa- 55 
tion in the second memory location (242), and 
copying the information from the second mem- 
ory location (242) to the control system mem- 
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